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Abstract: This paper considers the best sensor configuration and fault accommodation 
problem for inertial navigation systems which use seven inertial sensors such as 
gyroscopes and accelerometers. We prove that when six inertial sensors are used, the 
isolation of a double fault cannot be achieved for some combinations of fault magnitudes, 
whereas when seven inertial sensors are used, the isolation of any double fault can be 
achieved. There are many configurations which provide the minimum position errors. This 
paper proposes four configurations which show the best navigation performance and 
compares their FDI performances. Considering the FDI performance and the complexity of 
the accommodation rule, we choose one sensor configuration and provide accommodation 
rules for double faults. A Monte Carlo simulation is performed to show that the 
accommodation rules work well. 

Keywords: fault detection and isolation; fault accommodation; inertial sensors; parity 
equation; probability of correct isolation 



1. Introduction 

The reliability of any system can be enhanced by fault detection, isolation, and accommodation 
(FDIA). FDI methods have been studied since the 1960s in various areas of engineering problems. The 
reviews [1-3] and books [4,5] and references therein introduce various methods of FDI and diverse 
applications in engineering problems. 
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To make them reliable and enhance their navigation accuracy, inertial navigation systems (INS) 
often use redundant sensors. Numerous studies have been performed on the use of redundant inertial 
sensors in FDI, and there are many FDI papers on hardware redundancy, such as those based on 
look-up tables and the squared error (SE) method [6,7], generalized likelihood test(GLT) method [8], 
optimal parity test(OPT) method[9], multiple parity vector method [10], and reduced-order parity 
method for double faults [11]. 

Yang et al [10,12] suggested accommodation rules for single and double faults based on the error 
covariance of an estimated variable, which is related to the navigation accuracy of INS. These 
accommodation rules give decision criteria to determine whether faulty sensors should be excluded or 
not. Yang et al. [12] suggested accommodation rules for six inertial sensors. However, when six 
inertial sensors are used, a double fault can be detected, but the faults cannot be isolated in some cases. 
Accommodation rules for seven inertial sensors are suggested in [13], which is a conference version of 
this paper and the accommodation rules are obtained for the simplest sensor configuration among the 
four configurations which provide the best navigation performance. 

The present paper proves that when six inertial sensors are used, the isolation of a double fault 
cannot be achieved for some combinations of fault magnitudes whereas, when seven inertial sensors 
are used, isolation can be achieved for any double fault. The configuration which shows the best 
navigation performance is not unique. Actually, there are many configurations which provide 
minimum position errors. This paper proposes the four best configurations from the navigational 
viewpoint and provides accommodation rules for double faults for one of them. For the four best 
sensor configurations, the probability of correct isolation (PCI) is obtained and compared to select the 
configuration for which the accommodation rules are obtained. Considering the FDI performance and 
the complexity of the accommodation rule, we choose one sensor configuration among the four 
suggested configurations and provide accommodation rules for double faults. 

This paper is organized as follows. The sensor configuration and null space of the measurement 
matrix are explained in Section 2. The fact that seven inertial sensors should be used to isolate any 
double fault is proved, and the four best sensor configurations for navigation performance are given in 
Section 3. For these four sensor configurations, the PCIs are simulated and compared with each other 
in Section 3. The accommodation rules for a double fault for seven inertial sensors are given in 
Section 4. The simulation results and conclusions are given in Sections 5 and 6, respectively. 

2. Sensor Configuration and Null Space of Measurement Matrix 

2.1. Sensor Configuration 

Consider a typical measurement equation for redundant inertial sensors such as their acceleration 
or angular rate: 

m(t) = Hx(t) + f(t) + e(t) ( i ) 

where: 

m(t) = [mi m 2 . . . m n ] T e R n : inertial sensor measurement. 

H(t) = [hi I12 . . . h n ] T : nx3 measurement matrix of sensor configuration with rank(H) = 3. 
x(t) g R : triad-solution(acceleration or angular rate). 
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f(t) = [fi f 2 ... f n ] T e R n : fault vector. 

s(t) ~ N(0 n , al n ) : a measurement noise vector with normal distribution( white noise), all sensors are 
assumed to have the same noise characteristics. 

N(x, y): Gaussian probability density function with mean x and standard deviation y. 

The triad solution x(t) in (1) can be obtained by the least square method from the measurement 
as follows: 



x(t) = (H T H) _I H T m(t) 



(2) 



The navigation accuracy of INS depends on the estimation error of the triad solution x(t), as shown in 
Figure 1. The estimation error of the triad solution x(t) in (1) depends on the matrix H. Harrison 
et al. [14] mentioned the condition which provides the least estimation error of x(t) resulting in the best 
navigation performance. 



Lemma 1 [14]. Consider the measurement Equation (1), where the matrix H e R nx3 denotes the 
sensor configuration. When the eigenvalues of H T H are all equivalent to n/3, the sensor configuration 
provides the minimum estimation error of the triad solution x(t), which gives the best 
navigation performance. 

Figure 1. INS with redundant inertial sensor configuration and FDIA. 
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2.2. Null Space of Measurement Matrix 

A parity vector P(t) is obtained from the measurement using a matrix V as follows: 

p(t) = Vm(t) = Vf(t)+ Ve(t) 

where the matrix V satisfies: 

VH = 0(VeR (n - 3)xn ), VV T = I, V = [v x v 2 vj. 

The following Lemma shows the well-known singular value decomposition (SVD) result. 



(3) 
(4) 



Lemma 2. Suppose that n>3. Every matrix H e R nx3 with rank 3 can be transformed into the form 
H = UA = U[E 0] T = UiZ 
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where U and 2 satisfy the following. UU* =U*U=I n , U=[Ui U 2 ], Ui e R nx3 , U 2 e R nx(n " 3) , 2 = 
diag{ai, a 2 , CJ3} with ai > a 2 > c*3 > 0. ( )* denotes a complex conjugate transpose. 

Measurement Equation (1) can be described as follows: 

m = UiS x + f + s 
and the parity vector can be obtained by multiplying U 2 * on the left: 

p = U*rn = U*(f + £) (5) 
If we temporarily ignore the noise, we can obtain the null space projection of the fault f. 

A 

f„ull = U2P = U2U2*m = U 2 U2*f, 

where U2U2 is the projector into the null space of the measurement matrix H. Thus, we can estimate 

A 

the fault by using f nu n . 

Remark 1: The matrix U 2 * in (5) can be used as V in (3). There are many solutions satisfying (4) for 
matrix V and the SVD method provides one of them. 

3. Sensor Configuration for Seven Inertial Sensors 

3.1. The Number of Sensors Required to Isolate a Double Fault 

It is well-known that two faulty sensors can be isolated among six sensors. Gilmore et al. [6] 
mentioned that the symmetric configuration with six sensors arranged on dodecahedron enables self- 
contained failure isolation for up to two out of six sensors. This is correct when two faults occur at 
different times. However, in the case where two faults occur simultaneously, which is generally 
referred to as a double fault, the isolation of the two faults cannot be guaranteed, as will be proved in 
Theorem 1. 

Theorem 1. Consider the measurement Equation (1) with n=6. Suppose that the magnitude of the 
faults differ from each other, i.e., £ ± fj for i ^ j. Then, the isolation of the double fault cannot always 
be achieved for some combinations of and fj. 

Proof. Define a unit vector e x for which only the i th component is 1 and the other components are 
zero. Then we obtain double faults as follows: 

f jk = U 2 U; (f jej + f k e k ), 1 < j < k < 6 (6) 

A A 

The difference between fj k and fi m 

f jk -fim=U 2 U*(f j e j +f k e k -f x e x - f m e m ) (7) 

can be zero for non-zero fj, fk, fi and f m since U 2 U 2 * has a maximum of three independent columns and, 
thus, there exist some combinations of fj, fk, fi and f m which make (7) zero. Therefore, a double fault 
cannot be isolated for some combinations of fi and fj. 

The simulation result for Theorem 1 can be seen in [15]. If we need to isolate a double fault for any 
combination of £ and fj, seven sensors should be used. 
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Theorem 2. Consider the measurement Equation (1) with n=7. Then, the isolation of a double fault can 
be achieved for all combinations of and fj. 

Proof. Consider the double fault in (6), where U2 e R 7x4 . The difference value: 

A A 

fjk - fim = U 2 U 2 * (fjej + fke k - fiei - f m e m ) 
cannot be zero for non-zero combinations of fj, fk, fi and f m since U2U2 has a maximum of four 
independent columns. Thus, a double fault can be isolated for any combination of £ and fj. 

Considering the result of Theorem 2, we need to use seven sensors to isolate double faults in any 
situation. 

3.2. Four Sensor Configurations to Obtain Best Navigation Accuracy 

Lemma 1 gives the condition for the sensor configuration to provide the least estimation error of x 
in (2). Now we consider seven inertial sensors and there are many configurations which satisfy the 
condition, H T H = 7/3 I3. The configurations in Figures 2 through 5 all satisfy the condition, 
H T H = 7/3I 3 . 

Figure 2. Configuration 1 of seven inertial sensors. 
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3.3. FDI Performances of the Four Sensor Configurations 

In this section, we suggest an appropriate sensor configuration in the case where seven inertial 
sensors are used, which takes into consideration simultaneously the navigation performance, FDI 
performance, and the complexity of the accommodation rule. This section considers the FDI 
performances for the four sensor configurations described in Section 3.2. Even though these four 
configurations all show the best navigation performance, their FDI performances are different from 
each other. For each configuration, we obtain the probability of correct isolation (PCI) with respective 
to each sensor. The PCI is obtained from 3,000 simulation runs and the PCI value in Table 1 denotes 
the average value of 30 raw PCIs. The GLT method[8] is used for FDI algorithm with false alarm rate 
of 1 %. 

Table 1. PCI value for single fault (f = 7a, 3000 simulations, 30 averaged). 
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The FDI performances of the four sensor configurations do not differ from each other very much. 
However, we can recognize that configuration 1 shows the worst FDI performance among the four 
configurations, while configurations 2 and 4 are better than configuration 3. Even though the 
magnitude of the fault varies, the PCI values of the four configurations show similar trends to those in 
Table 1. Actually configuration 4 shows only slightly better PCI performance than configuration 2. 
However, we chose configuration 2 after considering the complexity of the accommodation rule. 
Configuration 2 has four sets of accommodation rules, which are explained in detail in Section 4.2, 
while configuration 4 has 13. The number of different combinations of seven different sensors, taken 
two at a time, without repetition, is iC2= 21. Figure 6 is redrawn for configuration 4 in Figure 5 and it 
shows symmetry; sensors 1 and 7 correspond to sensors 2 and 5, respectively, with respect to the plane 
consisting of sensors 3, 4, and 6. Among the 21 cases, eight are mirror images of the remaining 13 
cases, as shown in Table 2. Because of this complexity, we chose configuration 2 instead of 
configuration 4. 

Figure 6. Configuration 4 redrawn. 
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Table 2. Combinations of accommodation rules for Configuration 4 related to Figure 6. 
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4. Accommodation Rule for Seven Inertial Sensors 

4.1. Accommodation Rule for Single and Double Faults 

In this section, the results of [10,12] are used for the accommodation rules for single and 
double faults . 

Category 0 [10] : When a single fault satisfies the following inequality |y:|>^L, the faulty sensor 
should be excluded. The vector Vi is the i th column of matrix V in (4). 
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Category I [12]: When double faults satisfy the following three inequalities: 

i)f t 2 \m T HJ% \\ 2 2 +f. 2 IKlfH)- 1 ^ \\l +2 f.f. <(H T H)- 1 h 1 ,(H T H)" 1 h J > <, 

{IKtfHr'hjll^-IKH^Hr'hjll^} 2f i f j <(H T H)- 1 h i ,(H T H)- 1 h J > / a 2 

11) f +f. 1 ( 



\m T w%\\i 



\\(H T K)~\ " 2 



^-'hjeiivje-y 



iii)|fjl<|fil 

where c2 ||(H T Hr 1 h 1 lgl|v J ll^ll(H T H)-. J „ 2 „ Vlll; 

||(H T H)- 1 h 1 ||^||(H T H)- 1 h J |gD 1J 

DHIv 1 l| 2 ||v J || 2 -<v 1 ,v J > 2 . 
the two faulty sensors should not be excluded. 



and r =2< (U T UJ\ X^T% >< v x , Vj > 
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Category HI [12]: When double faults satisfy the following three inequalities: 
i) f t 2 \m T HJ% \\l +f/ IKtfH)" 1 ^ || 2 +2^fj <(H T H)" 1 h 1 ,(H T H)- 1 h J > >d 

iii) I f j I < I f*i I 
tr(A) 



where £ 2 = 



tr{B) 

A=cy 2 (H T H)- 1 



J_ 



[hihj] 



I l|2 T 

|Vj|| 2 -v jVi 

T II l|2 



V: 



i 112 



and 



B =(H T W 1 H) ^^/ (H T W 1 H)" 1 
the i-th sensor should be excluded, but not the j-th sensor. 



Category IV[12]: When double faults satisfy the following three inequalities: 

i) f t 2 \m T B) \ \\l +f. 2 \m J UJ% \\ 2 2 +2^ <(H T H)- 1 h 1 ,(H T H)" 1 h J > >C, 

ii) f/ * ^ 

iii) I f j I < I f i I 

the two faulty sensors should be excluded. 
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Remark 2: For categories I through IV above, we consider only half of the first quadrant in two 
dimensional space, i.e., 0 < 0 < n/4. 

4.2. Accommodation Rule of Configuration 2 

In Section 3.3, we choose sensor configuration 2, as shown in Figure 7, considering the navigation 
performance, FDI performance, and the complexity of the accommodation rule, altogether. 

Figure 7. Configuration 2 with seven inertial sensors. 

0.8819 0 0.4714 

0.4410 0.7638 0.4714 

-0.4410 0.7638 0.4714 

-0.8819 0 0.4714 

-0.4410 -0.7638 0.4714 

0.4410 -0.7638 0.4714 

0 0 1 



In this case, the measurement matrix H is given in (8) and has the following relations: 
H T H = 7/3I 3 , llh^ =1, || Vi | 2 =0.7559 (i=l,2, ... ,7) 

Configuration 2 in Figure 7 has six sensor input axes (i=l, ... ,6) on the cone with angle 61.8745° 
from the Z-axis and one sensor input axis (i=7) on the Z-axis. There are four kinds of combinations of 
double fault. Three double fault combinations take place on the cone (£ , i=l, ... ,6) : adjacent double 
faults (fi and fi+i), double faults skipping a sensor (£ and £+2), and double faults skipping two sensors 
(fi and fi+3). The other double fault combination takes place between the Z-axis (fj) and one sensor on 
the cone (fi , i=l, ... ,6). For simplicity, we call these faults the 1 st and 2 nd , 1 st and 3 rd , 1 st and 4 th , and 
1 st and 7 th faults, respectively. The regions of Category 0 through Category IV in Section 4.1 are 
shown in Figures 8 through 11, respectively, where "-i" means that the i th sensor should be excluded 
and means that the j th sensor should be included. 

Figure 8. Region of categories I through IV for 1 st and 2 nd faulty sensors for configuration 2. 
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Figure 9. Region of categories I through IV for 1 st and 3 rd faulty sensors for configuration 2. 
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Figure 10. Region of categories I through IV for l sl and 4 th faulty sensors for configuration 2 
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4.3. Implementation of the Accommodation Rules: Update Matrix W 

The accommodation rule is implemented by updating matrix W as in (9)-(12), where W_i_j denotes 



the identity matrix with the i th and j m diagonal components having zero values, and W_i denotes the 



•th 



Sensors 2009, 9 



8466 



identity matrix with the i th diagonal component having zero value. Figures 12 through 15 show the 
accommodation rule in the first quadrant. 



Figure 12. Accommodation rule for 1 st and 2 nd faulty sensors for configuration 2 
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Figure 13. Accommodation rule for l sl and 3 rd faulty sensors for configuration 2. 
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Figure 14. Accommodation rule for l sl and 4 th faulty sensors for configuration 2 
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Figure 15. Accommodation rule for l sl and 7 th faulty sensors for configuration 2 
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5. Simulations for Accommodation Rules 

In this section, Monte Carlo simulations are performed 10,000 times for each double fault 
combination to confirm that the accommodation rules are correct. Seven identical sensors are used 
with configuration 2 as shown in Figure 7. For the measurement matrix H in (8), the matrix V 
satisfying VH = 0 and VV T = I can be obtained by using the SVD method as follows: 



V = 



0.3223 -0.0842 -0.5298 0.7189 

0.1671 0.3628 -0.4380 -0.1871 

-0.2497 0.5564 -0.2722 0.0001 

-0.6142 0.3510 -0.1575 0.1398 



-0.2640 -0.1464 -0.0168 

0.6654 -0.3495 -0.2207 

-0.2381 0.5899 -0.3864 

-0.0472 -0.2826 0.6108 



where v ; 



, ||2 0.7559 (i= 1,2,..., 7). 

To show the navigation performance, the error covariance of the triad solution x is used. The 
covariance matrices are defined as follows: 



C +i+j =E[(x +i+j -x)(x +i+ . -x) ] 
C_ H =E[(x_ H -x) (x_ w -x) T ] 



C_ 1+J =E[(x_ 1+j -x)(x_ 1+; -x) T ] 



-i+J 



■i+y 



(13) 
(14) 
(15) 



Matrix C+i+j denotes the error covariance of x including the i th and j m sensor outputs and C_i_j the 
error covariance of x excluding the i th and j th sensors, and so on. It is known that the minimization of 
the trace of the error covariance matrix provides the best navigation performance. The traces of the 
error covariance matrices (13)— (15) will be calculated and compared with each other for the four 
accommodation rules, which results are shown in Figures 17, 19, 21, and 23. 
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5.1. Double Fault of I s and 2" Sensors 

Suppose that the first and second sensors have a fault such that f(t) = [fi f 2 0 0 0 0] T with ft and f 2 
being constants. Simulations are performed for each point on the linear line of f 2 = 0.5 ft as shown in 
Figure 16, and the measurement noise is white Gaussian with mean 0 and variance a = 1. 

Figure 17 shows the results of the accommodation rule for a double fault according to the fault size 
in Figure 16. When faults fi and f 2 belong to the region of Category I, the trace of C+i+ 2 is the 
minimum among the three traces. This means that when faults f\ and f 2 belong to the region of 
Category I, the two faulty sensors should be used to obtain the minimum estimation error, in other 
words, the best navigation accuracy. When faults fi and f 2 belong to the region of Categories II or III, 
the trace of C_i+ 2 is the minimum, and when they belong to the region of Category IV, the trace of C_i_ 2 
is the minimum. In Figure 16, the point at fi = 1.1 107 is the boundary between Category I and II, and 
the point at fi = 2.2968 is the boundary between Category III and IV. These boundary points 
correspond to the crossover points between trace(C+i+ 2 ) and trace(C_i+2) and between trace(C_i+2) and 
trace(C_i-2), respectively, in Figure 17. 

Figure 16. Accommodation rule for 1 st and 2 nd faulty sensors in Figure 12. 




Figure 17. Trace(C+i+ 2 ), trace(C_i+2)and trace(C_i-2) with respect to fault magnitude in Figure 16. 
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5.2. Double Fault of I s and 3 r Sensor 

Figure 19 shows the results of the accommodation rule for a double fault according to the fault size 
in Figure 18. The results are the same as those in Section 5.1. 

Figure 18. Accommodation rule for 1 st and 3 rd faulty sensors in Figure 13. 
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Figure 19. Trace(C+i+3), trace(C_i+3)and trace(d-3) with respect to fault magnitude in Figure 18. 




I> 1 1,4617 2 2.6666 3 4 5 6 

Fault size of number 1 sensor |F/>] 



5.3. Double Fault of I s and 4 Sensors 



Figure 21 shows the results of the accommodation rule for a double fault according to the fault size 
in Figure 20. The results are the same as those in section 5.1. 
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Figure 21. Trace(C+i+4), trace(C_i+4)and trace(C_i.4) with respect to fault magnitude in Figure 20. 
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5.4. Double Fault of I s and 7 Sensors 

Figure 23 shows the results of the accommodation rule for a double fault according to the fault size 
in Figure 22. The results are the same as those in Section 5.1. 

Figure 22. Accommodation rule for 1 st and 7 th faulty sensors in Figure 15. 
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Figure 23. Trace(C+i+7), trace(C_i+7)and trace(C_i-7) with respect to fault magnitude in Figure 22. 
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6. Conclusions 

For inertial navigation systems which use seven sensors, this paper proves that a double fault can be 
isolated for any combination of fault magnitudes. This paper suggests the four sensor configurations 
which provide the best navigation performance when seven sensors are used. The four sensor 
configurations are as follows: (1) cone configuration, (2) six sensor inputs on the cone surface and one 
sensor input on the center axis through the cone, (3) two sensors on the x and y axes, respectively, and 
the other five sensors on the cone surface with the z axis as center axis of the cone, (4) three sensors on 
the x, y, and z axes, respectively, and the other four sensors on the cone surface with the z axis as the 
center axis of the cone. 

For these four configurations, the PCI is obtained for each sensor in order to compare their FDI 
performance. The Monte Carlo simulations indicate that configuration 4 shows the best PCI, but which 
is only slightly better than that of configuration (4). As explained in detail in Sections 3.3 and 4.2, 
configuration (2) has four sets of accommodation rules, while configuration (4) has 13. Thus, we chose 
configuration (2) after considering the complexity of the accommodation rule. For sensor configuration (2), 
four accommodation rules are obtained and a Monte Carlo simulation is performed. The Monte Carlo 
simulation shows that the suggested accommodation rules are correct and work well. 
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